Understanding and Measuring Inter-Process Code Injection in Windows Malware

Malware aims to stay undetected for as long as possible. One common method for avoiding or delaying detection is the use of code injection, by which a malicious process injects code into another running application. Despite code injection being known as one of the main features of today’s malware, it is often overlooked and no prior research performed a comprehensive study to fundamentally understand and measure code injection in Windows malware. In this paper, we conduct a systematic study of code injection techniques and propose the first taxonomy to group these methods into classes based on common traits. Then, we leverage our taxonomy to implement models of the studied techniques and collect empirical evidence for the prevalence of each specific technique in the malware scene. Finally, we perform a large-scale, longitudinal measurement of the adoption of code injection, highlighting that at least 9.1% of Windows malware between 2017 and 2021 performs code injection. Our systematization and results show that Process Hollowing is the most commonly used technique across different malware families, but, more importantly, this trend is shifting towards other, less traditional methods. We conclude with takeaways that impact how future malware research should be conducted. Without comprehensively accounting for code injection and modeling emerging techniques, future studies based on dynamic analysis are bound to limited observations

Real Options Models without Single-Investment Threshold Behavior

This paper investigates real options models that violate the assumption of positive persistence of uncertainty. Without this fundamental assumption, existing methodologies are inadequate to address the firm's investment problem. To tackle this issue, we introduce a discrete-time version of a real options model and employ reinforcement learning, specifically Q-learning, to derive the optimal solution. Our findings reveal that in scenarios where the assumption of positive persistence of uncertainty is violated, the firm's investment behavior can exhibit disconnected investment regions

Real Options Models without Single-Investment Threshold Behavior

This paper investigates real options models that violate the assumption of positive persistence of uncertainty. Without this fundamental assumption, existing methodologies are inadequate to address the firm's investment problem. To tackle this issue, we introduce a discrete-time version of a real options model and employ reinforcement learning, specifically Q-learning, to derive the optimal solution. Our findings reveal that in scenarios where the assumption of positive persistence of uncertainty is violated, the firm's investment behavior can exhibit disconnected investment regions

Columnar structure formation of a dilute suspension of settling spherical particles in a quiescent fluid

The settling of heavy spherical particles in a column of quiescent fluid is investigated. The performed experiments cover a range of Galileo numbers ($110 \leq \text{Ga} \leq 310$) for a fixed density ratio of $\Gamma = \rho_p/\rho_f = 2.5$. In this regime the particles are known (M. Jenny, J. Du\v{s}ek and G. Bouchet, Journal of Fluid Mechanics 508, 201 (2004).) to show a variety of motions. It is known that the wake undergoes several transitions for increasing $\text{Ga}$ resulting in particle motions that are successively: vertical, oblique, oblique oscillating, and finally chaotic. Not only does this change the trajectory of single, isolated, settling particles, but it also changes the dynamics of a swarm of particles as collective effects become important even for dilute suspensions, with volume fraction up to $\Phi_V = \mathcal{O}\left(10^{-3}\right)$, which are investigated in this work. Multi-camera recordings of settling particles are recorded and tracked over time in 3 dimensions. A variety of analysis are performed and show a strong clustering behavior. The distribution of the cell areas of the Vorono\"i tessellation in the horizontal plane are compared to that of a random distribution of particles and shows clear clustering. Moreover, a negative correlation was found between the Vorono\"i area and the particle velocity; clustered particles fall faster. In addition, the angle between two adjacent particles and the vertical is calculated and compared to a homogeneous distribution of particles, clear evidence of vertical alignment of particles is found. The experimental findings are compared to simulations.Comment: 8 pages, 6 figure

Product Innovation of an Incumbent Firm:A Dynamic Analysis

In case of a product innovation firms start producing a new product. While doing so, such a firm should decide what to do with its existing product after the firm has innovated. Essentially it can choose between replacing the established product by the new one, or keep on producing the established product so that it produces two products at the same time. The aim of this paper is to design a theoretical framework to analyze this problem. Due to technological progress the quality of the newest available technology, and thus the quality of the innovative product that can be produced by this technology, increases over time. The implication is that a later innovation enables the firm to produce a better innovative product. So, typically the firm faces the tradeoff between innovating fast, which boosts its profits soon but only by a small amount, or innovating later, which leads to a larger payoff increase. The drawback here is that the firm is stuck with producing the established product for a longer time. We fund that a highly uncertain economic environment makes the firm delay abolishing the old product market. But if the innovative market is more volatile, the firm enters the market sooner, provided it will be active on the old market, at least for some time. Moreover, the smaller the initial demand for the innovative product market, the better the quality of the innovative product needs to be for the product innovation to be optimal

Issues in higher education policy : an update on higher education policy issues in 2004 in 11 Western countries

Higher education is a dynamic field. It is, however, also a field where changes don¿t take place overnight. This 2004 update report covers a period of 1.5 years, a period in which some earlier policy initiatives have been implemented and new ones have emerged. It is therefore not surprising to observe that many of the policy issues on the agenda in the previous Update Report (April, 2003) still are a topic of debate today.\ud The main part of the report are the descriptions of the current (2004) higher education debates and policy initiatives for each of the eleven IHEM countries, arranged in four themes educational and research infrastructure, finance, governance and quality. In conclusion, four `overarching¿ policy issues in contemporary European (and Australian) higher education are discussed. These issues are:\ud * The Bologna process and changing degree structures\ud * The changing organisation of research\ud * Financial accountability and responsibility\ud * Interactive governanc